WordPress Plugin Vulnerabilities

WPvivid Backup < 0.9.56 - Reflected Cross-Site Scripting

Description

The plugin does not escape the tab parameter before outputting it back in an admin dashboard page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
wpvivid-backuprestore
Fixed in 0.9.56

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
c269bff4-6dd3-46cb-bb3d-55605891572c

Timeline

Publicly Published
2021-08-09 (about 4 years ago)
Added
2021-08-09 (about 4 years ago)
Last Updated
2021-08-09 (about 4 years ago)

Other

Published
Title
Published
2024-11-20
Title
ForumEngine < 1.9 - Reflected Cross-Site Scripting
Published
2025-03-19
Title
Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting
Published
2025-01-16
Title
rng-refresh <= 1.0 - Reflected Cross-Site Scripting
Published
2025-04-03
Title
Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template
Published
2025-01-27
Title
WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps < 2.5.1 - Reflected Cross-Site Scripting